0sec-cli 0.24.1 → 0.26.0

package/chunks/chunk-HUZ2EC2R.js

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  installPackageForEcosystem,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath,
+  resolveLocalTargetPath
+} from "./chunk-R7VWEY45.js";
+
+// packages/core/dist/prepare.js
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { join, basename } from "node:path";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+function detectTargetType(target) {
+  if (target.startsWith("git@") || target.startsWith("git://") || target.endsWith(".git") || target.startsWith("https://github.com/")) {
+    return "source-code";
+  }
+  if (target.startsWith("http://") || target.startsWith("https://")) {
+    return "url";
+  }
+  if (isExplicitLocalTargetPath(target) || isExistingLocalTargetPath(target)) {
+    return "source-code";
+  }
+  if (/^(@[a-z0-9-]+\/)?[a-z0-9][a-z0-9._-]*(@.*)?$/.test(target)) {
+    return "npm-package";
+  }
+  return "source-code";
+}
+function installPackage(ecosystem, packageName, requestedVersion, emit) {
+  return installPackageForEcosystem(ecosystem, packageName, requestedVersion, emit);
+}
+function resolveRepo(repo, emit) {
+  const isUrl = repo.startsWith("https://") || repo.startsWith("http://") || repo.startsWith("git@") || repo.startsWith("git://");
+  if (!isUrl) {
+    const absPath = resolveLocalTargetPath(repo);
+    if (!existsSync(absPath)) {
+      throw new Error(`Repository path not found: ${absPath}`);
+    }
+    return { repoPath: absPath, cloned: false };
+  }
+  const tempDir = join(tmpdir(), `0-review-${randomUUID().slice(0, 8)}`);
+  mkdirSync(tempDir, { recursive: true });
+  emit({
+    type: "stage:start",
+    stage: "discovery",
+    message: `Cloning ${repo}...`
+  });
+  try {
+    execFileSync("git", ["clone", "--depth", "1", repo, `${tempDir}/repo`], {
+      timeout: 12e4,
+      stdio: "pipe"
+    });
+  } catch (err) {
+    rmSync(tempDir, { recursive: true, force: true });
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to clone ${repo}: ${msg}`);
+  }
+  const repoPath = join(tempDir, "repo");
+  emit({
+    type: "stage:end",
+    stage: "discovery",
+    message: `Cloned ${basename(repo.replace(/\.git$/, ""))}`
+  });
+  return { repoPath, cloned: true, tempDir };
+}
+async function validateUrl(url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const res = await fetch(url, {
+      method: "HEAD",
+      signal: controller.signal,
+      redirect: "follow"
+    });
+    if (!res.ok) {
+      throw new Error(`URL returned HTTP ${res.status}: ${url}`);
+    }
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`URL unreachable (timeout): ${url}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function prepare(target, type, opts, emit) {
+  switch (type) {
+    case "npm-package": {
+      let packageName = target;
+      let version = opts.packageVersion;
+      const atIdx = target.startsWith("@") ? target.indexOf("@", 1) : target.indexOf("@");
+      if (atIdx > 0) {
+        packageName = target.slice(0, atIdx);
+        version = version ?? target.slice(atIdx + 1);
+      }
+      const pkg = installPackage("npm", packageName, version, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "pypi-package": {
+      const pkg = installPackage("pypi", target, opts.packageVersion, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "cargo-package": {
+      const pkg = installPackage("cargo", target, opts.packageVersion, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "oci-image": {
+      const pkg = installPackage("oci", target, opts.packageVersion, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "source-code": {
+      const { repoPath, cloned, tempDir } = resolveRepo(target, emit);
+      return {
+        targetType: type,
+        resolvedTarget: repoPath,
+        repoPath,
+        cleanup: () => {
+          if (cloned && tempDir) {
+            try {
+              rmSync(tempDir, { recursive: true, force: true });
+            } catch {
+            }
+          }
+        }
+      };
+    }
+    case "url":
+    case "web-app": {
+      await validateUrl(target);
+      emit({
+        type: "stage:end",
+        stage: "discovery",
+        message: `URL reachable: ${target}`
+      });
+      return {
+        targetType: type,
+        resolvedTarget: target,
+        cleanup: () => {
+        }
+      };
+    }
+    default: {
+      const _exhaustive = type;
+      throw new Error(`Unknown target type: ${_exhaustive}`);
+    }
+  }
+}
+
+export {
+  detectTargetType,
+  prepare
+};

package/chunks/{chunk-SU4IHQQI.js → chunk-IUUNIJPM.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/cve/artifact-scraper.js
 import { createHash } from "node:crypto";

package/chunks/chunk-JGDA6EIJ.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  createLocalOllamaRoutingRuntime,
+  parseRoutingQualificationPlan,
+  qualifyTaskRouting,
+  taskRoutingFixtureRuntime
+} from "./chunk-3MWQNNJU.js";
+import {
+  LlmApiRuntime
+} from "./chunk-HS2NQ7K6.js";
+
+// packages/cli/src/commands/routing.ts
+import { readFileSync, writeFileSync, statSync } from "node:fs";
+function readRoutingJson(path) {
+  if (statSync(path).size > 2e6) throw new Error("routing input exceeds 2 MB limit");
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function registerRoutingCommand(program) {
+  program.command("routing-qualify").description("Explicit offline synthetic task-routing qualification; fixture/local modes make no external API calls").requiredOption("--plan <file>", "Reviewed qualification plan JSON with models and shared limits").requiredOption("--out <file>", "Report JSON destination").option("--allow-provider-calls", "Authorize API calls only for a model-api plan and its declared limits", false).option("--regress-model <model>", "Fixture-only negative control: corrupt this model's validation state").action(async (opts) => {
+    const plan = parseRoutingQualificationPlan(readRoutingJson(opts.plan));
+    if (plan.mode === "model-api" && !opts.allowProviderCalls) throw new Error("model-api qualification requires explicit --allow-provider-calls; no provider request sent");
+    if (plan.mode !== "fixture" && opts.regressModel) throw new Error("negative control injection is fixture-only");
+    const localRuntime = plan.mode === "local-model" ? createLocalOllamaRoutingRuntime(plan) : void 0;
+    const runtime = localRuntime ?? (plan.mode === "fixture" ? taskRoutingFixtureRuntime(plan.models, opts.regressModel) : new LlmApiRuntime({ type: "api", timeout: plan.timeCapMs, model: plan.models[0], agentModels: Object.fromEntries(plan.models.map((model, index) => [`candidate-${index}`, model])) }));
+    const controller = new AbortController();
+    const cancel = () => controller.abort(new Error("operator cancelled qualification"));
+    process.once("SIGINT", cancel);
+    try {
+      const report = await qualifyTaskRouting({ plan, runtime, signal: controller.signal });
+      if (localRuntime) {
+        const observation = await localRuntime.observation();
+        report.localRuntime = observation;
+        report.externalApiFeeUsd = observation.externalApiFeeUsd;
+      }
+      writeFileSync(opts.out, JSON.stringify(report, null, 2) + "\n", { mode: 384 });
+      console.log(`${report.mode}: ${report.status}; ${report.totalCalls} calls; estimated USD ${report.estimatedUsd ?? "unknown"}; external API fee ${report.externalApiFeeUsd ?? "unknown"}; compute cost unknown; actual provider charge unknown; report ${opts.out}`);
+      if (report.status !== "completed-for-review") process.exitCode = 1;
+    } finally {
+      process.removeListener("SIGINT", cancel);
+    }
+  });
+}
+
+export {
+  readRoutingJson,
+  registerRoutingCommand
+};

package/chunks/{chunk-CJRZSWII.js → chunk-K3PTYN43.js}

@@ -4,10 +4,10 @@ const require = __0CreateRequire(import.meta.url);
 import {
   BackendIdSchema,
   requireBackendCapability
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/cli/src/remote-workflow-runtime.ts
 var executionSchema = external_exports.object({ id: external_exports.string().min(1).max(160), status: external_exports.enum(["queued", "running", "completed", "failed", "cancelled", "interrupted"]) }).passthrough();
@@ -47,7 +47,7 @@ async function createRemoteWorkflowRuntime(options, suppliedRegistry) {
   if (options.engineUrl && (options.backendId || options.configPath)) throw new Error("--engine-url cannot be combined with a registered backend.");
   if (Boolean(options.engineUrl) !== Boolean(options.engineTokenEnv)) throw new Error("Direct engine attachment requires both --engine-url and --engine-token-env.");
   const backendId = BackendIdSchema.parse(options.backendId ?? (options.engineUrl ? "attached-engine" : void 0));
-  const registry = suppliedRegistry ?? new (await import("./backend-connections-ACIXNYZN.js")).BackendConnectionRegistry(options.engineUrl ? { connections: [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] } : { configPath: options.configPath });
+  const registry = suppliedRegistry ?? new (await import("./backend-connections-64PKYKL7.js")).BackendConnectionRegistry(options.engineUrl ? { connections: [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] } : { configPath: options.configPath });
   try {
     const connection = await registry.handshake(backendId);
     if (connection.backend.transport !== "http") throw new Error("Select a registered remote HTTP backend; local execution cannot use this transport.");

package/chunks/{chunk-2NBZZFRG.js → chunk-KCABBZHN.js}

@@ -10,28 +10,28 @@ import {
   validateWorkbenchSourceLesson,
   workbenchConfigPath,
   workbenchNetworkEnabled
-} from "./chunk-X2IPO5JO.js";
+} from "./chunk-V2KJQVYE.js";
 import {
   createWorkbenchProviderBroker
-} from "./chunk-ZM6ANQZJ.js";
+} from "./chunk-3MWQNNJU.js";
 import {
   HuntMemoryStore,
   LearningService
-} from "./chunk-5WAHHZBF.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   LearningStore,
   learningArtifactDigest,
   learningProjectId,
   osecDB
-} from "./chunk-BMDG6T7D.js";
+} from "./chunk-72PU46MS.js";
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-PVJUPIQG.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   SERVICE_PLUGIN_CATALOG,
   findingSchema,
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/cli/src/web/service-plugins.ts
 import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, chmodSync } from "node:fs";
@@ -103,10 +103,8 @@ function createIsolatedConsoleSession(config, options = {}) {
         if (realpathSync(context.workspaceRoot) !== approvedWorkspace) return [];
         const memory2 = hostMemory();
         return withLearning((service) => {
-          const entries = service.importCodebaseNotes(learningProjectId(context.scopePath), context.scopePath, memory2, 8);
-          return memory2.recallCodebase(context.scopePath, 6).flatMap((note) => {
+          return service.recallCodebaseNotes(learningProjectId(context.scopePath), context.scopePath, memory2, 6).flatMap((note) => {
             const sourceLinks = note.codebase.files.map((file) => ({ path: file.path, hash: file.digest }));
-            if (!entries.some((entry) => entry.status === "current" && entry.summary === note.summary && JSON.stringify(entry.sourceLinks) === JSON.stringify(sourceLinks))) return [];
             const lesson = { title: note.title, summary: note.summary, sourceLinks: sourceLinks.map((link) => ({ ...link, path: relative(context.workspaceRoot, resolve(context.scopePath, link.path)).split(sep).join("/") })) };
             try {
               return [validateWorkbenchSourceLesson(lesson, context.workspaceRoot, context.scopePath)];
@@ -287,7 +285,7 @@ var ServicePluginServices = class {
   }
   async #probe(connection) {
     try {
-      const probe = this.#options.probe ?? (await import("./dist-TQMHMSBZ.js")).testServicePluginConnection;
+      const probe = this.#options.probe ?? (await import("./dist-ONIRKDH6.js")).testServicePluginConnection;
       const result = await probe(connection);
       if (!Array.isArray(result.tools) || result.tools.length > 512 || result.tools.some((tool) => typeof tool.name !== "string" || tool.name.length > 256 || typeof tool.description !== "string" || tool.description.length > 16384)) throw new Error("Invalid tool catalog.");
       const configurations = [...readStore(this.#options.homeDir), connection];

package/chunks/{chunk-3LPBJMHB.js → chunk-LRD5N2TQ.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/agent/journal/types.js
 var JOURNAL_SCHEMA_VERSION = 1;

package/chunks/{chunk-SQCBHFWN.js → chunk-LWMEJYCP.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/core/dist/protocol/http-conformance.js
 import { randomUUID } from "node:crypto";
@@ -20,7 +20,7 @@ var HTTP_SURFACES = ["method", "header", "status"];
 var httpExerciseSchema = external_exports.object({
   method: external_exports.string().min(1),
   path: external_exports.string().optional(),
-  headers: external_exports.record(external_exports.string()).optional(),
+  headers: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   body: external_exports.string().optional()
 }).strict();
 var conformanceRuleSchema = external_exports.object({

package/chunks/chunk-MNK373HF.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  source_default
+} from "./chunk-HLFS6WV2.js";
+
+// packages/cli/src/utils.ts
+import { gzipSync } from "zlib";
+async function getRuntimeAvailability() {
+  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-ONIRKDH6.js");
+  const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
+  const hasApiKey = apiRuntimeDiagnostics.valid;
+  const availableRuntimes = [...await detectAvailableRuntimes()];
+  return {
+    hasApiKey,
+    availableRuntimes,
+    apiRuntime: {
+      configured: apiRuntimeDiagnostics.reason !== "missing_key",
+      valid: apiRuntimeDiagnostics.valid,
+      providerLabel: apiRuntimeDiagnostics.providerLabel,
+      error: apiRuntimeDiagnostics.fatalError
+    }
+  };
+}
+async function checkRuntimeAvailability(runtime) {
+  const availability = await getRuntimeAvailability();
+  const { hasApiKey, availableRuntimes, apiRuntime } = availability;
+  if (hasApiKey) return;
+  console.log("");
+  if ((runtime === "api" || runtime === "auto") && apiRuntime.configured && apiRuntime.error) {
+    console.log(source_default.red(`  ${apiRuntime.providerLabel} config error: ${apiRuntime.error.split("\n")[0]}`));
+  }
+  if (runtime === "api") {
+    console.log(source_default.yellow(
+      apiRuntime.configured ? "  Warning: `--runtime api` needs a valid provider configuration. AI analysis will fail until this is fixed." : "  Warning: `--runtime api` needs provider credentials. AI analysis may be skipped."
+    ));
+  } else if (availableRuntimes.length > 0) {
+    console.log(source_default.cyan(`  Using local runtime(s): ${availableRuntimes.join(", ")}`));
+  } else {
+    console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
+  }
+  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
+  console.log("");
+}
+function buildShareUrl(report) {
+  const json = JSON.stringify(report);
+  const compressed = gzipSync(Buffer.from(json, "utf-8"));
+  const b64 = compressed.toString("base64url");
+  return `https://0.security/r#${b64}`;
+}
+
+export {
+  getRuntimeAvailability,
+  checkRuntimeAvailability,
+  buildShareUrl
+};

package/chunks/{chunk-R2XBH476.js → chunk-MOEVVXML.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   executeWorkflow
-} from "./chunk-ZM6ANQZJ.js";
+} from "./chunk-3MWQNNJU.js";
 import {
   SecurityWorkflowStore
-} from "./chunk-BMDG6T7D.js";
+} from "./chunk-72PU46MS.js";
 
 // packages/cli/src/managed-operation.ts
 async function executeManagedOperation(options, dependencies = { store: (path) => new SecurityWorkflowStore(path) }) {